Initia Blockchain Faces Second Hack in a Month, Losing $3.27 Million

The Initia blockchain has experienced its second hacking incident in less than three weeks, resulting in the theft of approximately $3.27 million in crypto assets. The breach occurred on November 9 when an attacker exploited a command injection vulnerability linked to a compromised Google Cloud Platform (GCP) key.

This security lapse allowed the hacker to access critical environment variables, enabling unauthorized entry into Initia's GitHub and GCP accounts. Subsequently, they gained access to Anvil, the hosting service for rollups within the Initia network. This access permitted the attacker to validate fraudulent IBC withdrawals from five rollups, unlocking assets held in the Initia L1’s IBC escrow accounts.

As a result, around $3.27 million worth of assets were transferred to the hacker's Initia L1 address, although $2.16 million of these funds remain frozen on the halted network and are currently inaccessible to the attacker. The hacker proceeded to liquidate stolen assets on Initia's decentralized exchange, withdrawing 13,400 TIA, 8,000 USDC.inj, and 597,000 Noble USDC while hitting the outbound IBC rate limits. Notably, no INIT tokens were withdrawn.

In response to the incident, the Initia team has paused the blockchain's operations. They are committed to restoring the backing of affected assets and are in the process of rebuilding their infrastructure from the ground up in a secure, isolated environment. This comprehensive security overhaul, which includes enforcing strict access controls and enhancing security measures, is expected to take longer than typical network recovery efforts.

This latest breach follows a previous incident on October 23, where Initia lost $2.7 million due to a vulnerability in the MoveVM script cache, which allowed a hacker to bypass security checks and create unbacked tokens that were then drained through a cross-chain bridge.

All updates regarding the situation will be communicated through Initia’s official channels as they work to resolve these security issues.